7b59997f4efdf54a64dbbcb60c98d02dde50772b39552f9c7bd9c2fa809887b3 | Triage

Analysis

max time kernel
29s
max time network
33s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
27-11-2022 05:50

Sharing

Report Analysis Logs

General

Target

ZMApi.dll
Size

292KB
MD5

97f5efa288eda2b70388f0900f2fdf35
SHA1

3d3ef1bc1ebbe172de61289c49a95c9dbaba940f
SHA256

ad0da0c9dc2196527ce9cc208cfe10e40bc746553a16387909afb29365c2f62d
SHA512

2ce182d21052729efb959cc9422943896315e334c73c381c052502c4f04afcf72b5f30bd952abaa5dbe993d270e989fa2ecd484404bc8e24b4f19d89090bf4b9
SSDEEP

6144:135zm5Oysu+wf3Qe1pgT6vH5UUNmBvvaH:13lm5Oy5/fgm6T6RUQiv

Score

1^/10

Malware Config

Signatures

Modifies registry class 10 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{8F08C31B-DDA6-44CD-95A3-6B81764432DC}\1.0\0\win32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ZMApi.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{8F08C31B-DDA6-44CD-95A3-6B81764432DC}\1.0\HELPDIR	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{8F08C31B-DDA6-44CD-95A3-6B81764432DC}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{8F08C31B-DDA6-44CD-95A3-6B81764432DC}\1.0	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{8F08C31B-DDA6-44CD-95A3-6B81764432DC}\1.0\FLAGS	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{8F08C31B-DDA6-44CD-95A3-6B81764432DC}\1.0\0	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{8F08C31B-DDA6-44CD-95A3-6B81764432DC}\1.0\ = "Zmapi"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{8F08C31B-DDA6-44CD-95A3-6B81764432DC}\1.0\FLAGS\ = "0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{8F08C31B-DDA6-44CD-95A3-6B81764432DC}\1.0\0\win32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{8F08C31B-DDA6-44CD-95A3-6B81764432DC}\1.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Local\\Temp"	regsvr32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 964 wrote to memory of 1736	964	regsvr32.exe	28
PID 964 wrote to memory of 1736	964	regsvr32.exe	28
PID 964 wrote to memory of 1736	964	regsvr32.exe	28
PID 964 wrote to memory of 1736	964	regsvr32.exe	28
PID 964 wrote to memory of 1736	964	regsvr32.exe	28
PID 964 wrote to memory of 1736	964	regsvr32.exe	28
PID 964 wrote to memory of 1736	964	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\ZMApi.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:964
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\ZMApi.dll
  2⤵
  - Modifies registry class
  PID:1736

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/964-54-0x000007FEFC4E1000-0x000007FEFC4E3000-memory.dmp

Filesize
8KB

Download
memory/1736-55-0x0000000000000000-mapping.dmp

Download
memory/1736-56-0x0000000076411000-0x0000000076413000-memory.dmp

Filesize
8KB

Download